Skip to content

Support SNI routing in bookkeeper#2431

Draft
sijie wants to merge 1 commit intoapache:masterfrom
sijie:support_sni_routing
Draft

Support SNI routing in bookkeeper#2431
sijie wants to merge 1 commit intoapache:masterfrom
sijie:support_sni_routing

Conversation

@sijie
Copy link
Member

@sijie sijie commented Oct 8, 2020

Descriptions of the changes in this PR:

Motivation

Netty supports sending SNI header on TLS handshake (netty/netty#3801 (comment)).

This PR uses that Netty feature to send SNI header while connecting to proxy software. So we can add proxy servers (e.g. Envoy, Nginx)
in front of bookies.

Changes

  • Add two configurations: bookieServiceUri and bookieConnectionMode. So the bookkeeper client can configure how it should connect to bookies.
  • Send SNI header on TLS handshake

Netty supports sending SNI header on TLS handshake (netty/netty#3801 (comment)).

This PR uses that Netty feature to send SNI header while connecting to a proxy software. So we can add proxy servers (e.g. Envoy, Nginx)
in front of bookies.
@sijie sijie self-assigned this Oct 8, 2020
@sijie
Copy link
Member Author

sijie commented Oct 8, 2020

This is a draft to introduce sending SNI header in bookkeeper client. However, I think we need one more chance to make it work. Because in bookkeeper protocol, we use STARTTLS for promoting an insecure connection to TLS secured connection. That means we send requests before STARTTLS.

Copy link
Contributor

@rdhabalia rdhabalia left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM..

@eolivelli
Copy link
Contributor

Now that we have advanced service discovery (BP-38) and the new BookieId abstraction (BP-41, not yet landed completely) the Bookie could publish a pure-TLS endpoint on discovery metadata (BookieServiceInfo) and then the client could use directly that information

@sijie
Copy link
Member Author

sijie commented Oct 8, 2020

@eolivelli Are you working on publishing a pure-TLS endpoint on discovery metadata?

@eolivelli
Copy link
Contributor

@sijie I am not working on TLS, the mechanism of BP-41 is quite generic, so we will be free to support new protocols for the Bookie seamlessly in the future, once the BP-41 is finished (missing a couple of patches currently, but I feel it will be ready for BK 4.12.0)

@sijie
Copy link
Member Author

sijie commented Oct 8, 2020

@eolivelli okay will look into publishing a pure-TLS endpoint

@eolivelli
Copy link
Contributor

@sijie PTAL here for the discovery mechanisms (BP-38)
https://github.com/apache/bookkeeper/pull/2214/files

here (BP-41 part 1 - already landed to master branch) the client is now able to leverage BP-38
#2404

@eolivelli
Copy link
Contributor

BP-41 has basically landed to master, so this work can move forward

@jiazhai jiazhai added this to the 4.13.0 milestone Nov 10, 2020
@dlg99
Copy link
Contributor

dlg99 commented Feb 11, 2021

please update TLS tests with test for SNI

@dlg99 dlg99 modified the milestones: 4.13.0, 4.14.0 Feb 16, 2021
@dlg99 dlg99 modified the milestones: 4.14.0, 4.15.0 May 7, 2021
@dlg99 dlg99 modified the milestones: 4.15.0, 4.16.0 Mar 11, 2022
@hangc0276 hangc0276 modified the milestones: 4.16.0, 4.17.0 Jul 29, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

6 participants